Clik here to view.
The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library
Six years ago, I wrote a blog post titled Soatok’s Guide to Side-Channel Attacks in which I discussed the general topic of side-channels in cryptographic applications, and how to avoid them, with...
View ArticleClik here to view.
Multi-Track Fursuiting?!
Last month, I attended both DEFCON and Megaplex. If you’re not familiar with either event, here’s all you need to know. DEFCON is a hacker convention with a substantial furry presence. Megaplex is a...
View ArticleClik here to view.
The Long Tail of Work Left Until ActivityPub Has E2EE
Separate from my proposal for key transparency for the Fediverse (which I’ve certainly blogged about a lot), the W3C has been working on building out end-to-end encryption (E2EE) for ActivityPub. The...
View ArticleClik here to view.
Soatok’s Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and...
View ArticleClik here to view.
Hybrid Constructions: The Post-Quantum Safety Blanket
The funny thing about safety blankets is they can double as stage curtains for security theater. Art: CMYKat “When will a cryptography-relevant quantum computer exist?” is a question many...
View ArticleClik here to view.
Cryptography Engineering Has An Intrinsic Duty of Care
To understand my point, I need to first explain three different cryptography attack papers / blog posts. I promise this won’t be boring. Three Little Disclosures Misuse-Prone Ciphers For All In a blog...
View ArticleClik here to view.
Cryptographic Issues in Matrix’s Rust Library Vodozemac
If you’re reading this after Matrix’s blog post, make sure you read the addendum to this one. Two years ago, I glanced at Matrix’s Olm library and immediately found several side-channel...
View ArticleClik here to view.
Is End-to-End Encryption Optional For Large Groups?
One of the recent topics in Messaging App Discourse is whether it makes sense to prioritize End-to-End Encryption (E2EE) when searching for an alternative to Discord. Who’s Saying “No”? I’m going to...
View ArticleClik here to view.
On Discord Alternatives
Next month, Discord is going to start requiring age verification. The backlash from gamers everywhere has been predictable and justified. I guess their company name checks out....
View ArticleClik here to view.
Software Assurance & That Warm and Fuzzy Feeling
If I were to recommend you use a piece of cryptography-relevant software that I created, how would you actually know if it was any good? Art: Wayward Mutt Trust is, first and foremost, a social...
View ArticleClik here to view.
Practical Collision Attack Against Long Key IDs in PGP
In response to the GPG.Fail attacks, a Hacker News user made this claim about the 64-bit “Long Key IDs” used by OpenPGP and GnuPG, while responding to an answer I gave to someone else’s question: OK,...
View ArticleClik here to view.
Everything You Need to Know About Email Encryption in 2026
If you think about emails as if they’re anything but the digital equivalent of a postcard–that is to say, postcards provide zero confidentiality–then someone lied to you and I’m sorry you had to find...
View ArticleClik here to view.
The Revolution Will Not Make the Hacker News Front Page
(with apologies to Gil Scott-Heron) If you get all of your important technology news from “content aggregators” like Hacker News, Lobste.rs, and most subreddits, you might be totally unaware of the...
View ArticleClik here to view.
Announcing Key Transparency for the Fediverse
I’m pleased to announce the immediate availability of a reference implementation for the Public Key Directory server. This software implements the Key Transparency specification I’ve been working on...
View ArticleClik here to view.
Moving Beyond the NPM elliptic Package
If you’re in a hurry, head on over to soatok/elliptic-to-noble and follow the instructions in the README in order to remove the elliptic package from your project and all dependencies in node_modules....
View ArticleClik here to view.
The Dreamseeker’s Vision of Tomorrow
Since I have your attention for the moment, I’d like you to ask yourself a question: What is it that drives you in life? Do you yearn for the feeling of safety? By seeking power, status, wealth, and...
View ArticleClik here to view.
Are You Under the Influence? The Tail That Wags The Dog
It is tempting and forgivable to believe that we’re in control of our social media experiences. After all, we write what we want in our bio, select our avatars, and even come up with our own handles....
View ArticleClik here to view.
It’s a Cold Day in Developer Hell, So I Must Roll My Own Crypto
I have several projects in-flight, and I wanted to write a quick status update for them so that folks can find it easier to follow along. Please bear in mind: This is in addition to, and totally...
View ArticleClik here to view.
Barking Up The Ratchet Tree – MLS Is Neither Royal Nor Nude
One of the first rules you learn about technical writing is, “Know your audience.” But often, this sort of advice is given without sufficient weight or practical examples. Instead, you’re ushered...
View ArticleClik here to view.
Improving Geographical Resilience For Distributed Open Source Teams with FREON
In a recent blog post, I laid out the argument that, if you have securely implemented end-to-end encryption in your software, then the jurisdiction where your ciphertext is stored is almost...
View Article
![ONEW – KAKERA -Unmei no Piece- – EP [iTunes Plus M4A]](http://is1-ssl.mzstatic.com/image/thumb/Music221/v4/d0/fb/86/d0fb86a5-ba60-4bea-41fb-7f54c125f518/VEATP-45908.jpg/296x296bb.webp)
